NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Forensics
Indicators of Compromise (IOCs)
Master extracting and utilizing Indicators of Compromise (IOCs). Learn to identify file hashes, network signatures, and host artifacts for effective threat hunting.
Room tasks
1What Are IOCs and Why Do They Matter
2Types of IOCs (Hashes, IPs, Domains, Registry Keys)
3Guided Lab: Building an IOC Report from a Sample
Frequently Asked Questions
What is an indicator of compromise?
An indicator of compromise is evidence that a system may have been breached, such as a malicious file hash, IP address, domain or registry key. Defenders use IOCs to detect and block known threats.
What is the difference between IOCs and IOAs?
IOCs are artefacts left behind by an attack, while indicators of attack describe attacker behaviour or intent as it happens. IOAs tend to age better because they do not depend on specific values.
How are IOCs used in threat hunting?
Hunters search logs, endpoints and network data for known indicators, then pivot to related activity. This free Codelivly room teaches how to identify and apply IOCs from malware analysis.